Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
quarkusio quarkus — Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H N N 7.5 .0046 38.4 —
AFFECTED
Product Versions Fixed
quarkus >= 3.36.0, < 3.36.3 – —
TIMELINE
Jun 4 Reserved by GitHub_M
Jun 19 EXPLOIT PUBLISHED — CVE-2026-50559 (quarkusio quarkus). Public exploit reference added.
Jun 19 Published (CNA: GitHub_M)
Aug 13 EXPLOIT PUBLISHED — CVE-2026-50559 (quarkusio quarkus). Public exploit reference added.
Description
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 4, 2026 | Reserved | Reserved by GitHub_M |
| June 19, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-50559 (quarkusio quarkus). Public exploit reference added. |
| June 19, 2026 | Published | Published (CNA: GitHub_M) |
| August 13, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-50559 (quarkusio quarkus). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| quarkusio | quarkus | — | >= 3.36.0, < 3.36.3 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-50559 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.